Why you should take care of infrastructure drift
summary
As Terraform-managed AWS accounts diverge from live resources, undetected changes cause security and cost failures: a rogue IAM access key plus an added admin policy stays invisible to terraform plan while remaining active for weeks, a security group gets changed to allow 0.0.0.0/0 and sits open for weeks, and manual enabling of S3 versioning explodes storage bills. The solution scans AWS against one or many Terraform states, reports resource-level coverage percent (example output showed 77% coverage dropping to 63%), and integrates via CI using driftctl.
AI-written summary · about
chapters (10)
- 0:00Introduction to drift
- 1:35What is infrastructure drift
- 4:50Dangers of drift and security
- 8:06First drift story and demo
- 12:04Second drift story and demo
- 17:21Third drift story and demo
- 21:38Using driftctl features
- 24:09Driftignore and filters
- 26:58CI pipeline integration
- 28:47Summary and call to action
related talks
24mWhy you should take care of infrastructure drift
31mWhy You Should Take Care of Infrastructure Drift
27mThe State of Infrastructure Drift: What We Learned From 100+ DevOps Teams
21mFrom Ghost Assets to Infrastructure Drift - Don't Get Spooked
30mDon't Panic: Getting Your Infrastructure Drift Under Control
26mTerraform Config Drift How to Handle Out of Band Infrastructure Changes
32mManaging Terraform resource drift using the GitOps method
51mTerraform Cloud Learn Lab: Validate Infrastructure, Detect Drift & Enforce OPA Policies